We follow an analysis approach previously employed to audit DP [1]}, [2]}.
We extend the analysis to be able to reason about both pure DP where \(\delta =0\)  and the more commonly employed \((\varepsilon , \delta )\)  variant, unlike prior work which assumes \(\delta \)  is always negligible [2]}.
We define one instance of the attack as the Crafter choosing a pair of datasets,
the model being trained on one of these, and the Distinguisher making its guess.
For a fixed training algorithm we would like to run, we define a pair of adversaries.
Then, we run a large number of instances on this problem setup.
Through Monte Carlo methods, we can then compute a lower bound on the \((\varepsilon ,\delta )\) -DP.
